feat(dgw): enable Kerberos injection without debug flags - #1953
Open
irvingouj@Devolutions (irvingoujAtDevolution) wants to merge 2 commits into
Open
Conversation
irvingouj@Devolutions (irvingoujAtDevolution)
had a problem deploying
to
onedrive-upload
August 25, 2026 16:57 — with 
GitHub Actions
Failure
GitHub Actions
Failure
irvingouj@Devolutions (irvingoujAtDevolution)
force-pushed
the
feat/enable-kerberos-injection
branch
from
August 25, 2026 17:03
2e319fb to
fa5643b
Compare
Copilot started reviewing on behalf of
irvingouj@Devolutions (irvingoujAtDevolution)
August 25, 2026 21:22
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Promotes Kerberos credential injection from an unstable opt-in to standard Gateway behavior.
Changes:
- Enables Kerberos selection in both RDP injection paths.
- Removes the KDC proxy’s unstable-feature gate.
- Retains legacy configuration keys as ignored compatibility options.
Prose verification was skipped because no line-break-sensitive prose changed.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
devolutions-gateway/src/rd_clean_path.rs |
Enables Kerberos checkout for RDCleanPath. |
devolutions-gateway/src/generic_client.rs |
Enables Kerberos checkout for generic RDP forwarding. |
devolutions-gateway/src/credential_injection.rs |
Removes the debug opt-in helper and tests. |
devolutions-gateway/src/config.rs |
Marks the legacy setting as ignored. |
devolutions-gateway/src/api/kdc_proxy.rs |
Removes the unstable-feature request gate. |
config_schema.json |
Documents the legacy setting as ignored. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1421
to
1423
| /// Ignored. Kerberos credential injection is stable and no longer gated here. | ||
| #[serde(default)] | ||
| pub kerberos_credential_injection: bool, |
| } | ||
|
|
||
| /// Whether target username + opt-in select Kerberos injection (otherwise NTLM). | ||
| /// Whether the target username should use Kerberos injection (otherwise NTLM). |
Kerberos credential injection no longer requires __debug__.enable_unstable or kerberos_credential_injection. Those keys still parse so existing configs keep loading. Issue: DVLS-14697 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
irvingouj@Devolutions (irvingoujAtDevolution)
force-pushed
the
feat/enable-kerberos-injection
branch
from
August 25, 2026 22:18
662c8c5 to
6667a0a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Kerberos credential injection no longer requires
debug.enable_unstable or kerberos_credential_injection.
Those keys still parse so existing configs keep loading.
Issue: DVLS-14697
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
Stack created with GitHub Stacks CLI • Give Feedback 💬